JapanSl ysan
Ayecuritt:
edocllehTSNIRnPiGBndeare DConfe202ecn
re0dw
liaHM
lfiov
nEtioulov
EThe

Malware Researcher

CiYi "YCY" Yu
Aragorn TsengMalware Researcher!

CiYi "YCY" Yu
1PMalware Analysis
Campaign Tracking
Automated Analysis

Aragorn Tseng
2P

Malware analysis
Incident response
Machine learning

AGENDA✚ Adversary Profile: HUAPI✚ Malware Profile: DBGPRINT✚ Evolution of DBGPRINT✚ In-Depth Analysis of DBGPRINT✚ Detection Warfare✚ Remediation & Detection

Adversary Profile: HUAPIAlias BlackTechu Since 2007
u Malware:u TSCOOKIEu KIVARS
u CAPGELDu DBGPRINTu

Malware Profile: DBGPRINTAlias Waterbearu Since at least 2009u DLL export name “DbgPrint”
uActed as second stage
u Advanced malware designu Adopt shellcode stager
u Able to load the pluginsuMalware Profile: DBGPRINT

Government

Education

Think Tank

FinanceTechnologyHealthcare

Evil Hidden in Shellcode: The Evolution of Malware DBGPRINT

Evolution of DBGPRINT

Version Changes in the Wild
0.13

0.17

0.120100.22011

2012

2013

2014

0.16
2015

2016

Discovery time in the wild

10.24
2017

2018

2019

2020

b.0.1

0.14
• Listen port

0.1.0

0.1.n0.2b

Access Payload
EXE

EXE

Inside EXE

EXE
DLL

DLL
Stager Payload

EXE

Stager Payload

Inside DLL

DLL

DLL

Stager Payload

Stager Payload

Standalone payload

Double DLL SideloadingRC4 Key of Payload
mov al, byte ptr [ecx]mov dl, al
shr dl, 3shl al, 5or dl, al
mov byte ptr [ecx], dl
inc ecx
dec esijnz short 100010CD

XOR / Shift

0103

FF

89

1372

D10A40C021BB

Random 16 bytes

C:\Program
Files\NVIDIA
Corporation\Display\nvwss.ptn\x00

Miss You! printupg.PNF

File path

String + File nameEvil Hidden in Shellcode: The Evolution of Malware DBGPRINT

In-Depth Analysis of DBGPRINTExecution Procedure
AccessDecrypt

PayloadStagerImplant

DBGPRINT Controller❶ Ask for DLL implant❷ Wait for connection

Inside DBGPRINT Stager

DBGPRINT Stager

Check PEB!IsDebugged

Test connection

Relocatefunction table

Generate session keys

Initialize API fromhash table

Check for challenge

Check for proxy setting

Decrypt implant &Execute in memory

In some version

FailDrop connection

Inside DBGPRINT Stager
DBGPRINT Controller

DBGPRINT Stager
Generate request
packetCheck for challenge

Decrypt implant andexecute in memory

Request the DBGPRINT implantwith session keys

Send the calculated challenge

Send the DBGPRINT implant

Calculate thepre-session key andchallenge

Split implant into
encrypted blocks

Inside DBGPRINT Stager
DBGPRINT Controller

DBGPRINT Stager

Request the DBGPRINT implant
Generate request
Generate request– Generate header
withpacketsession keys
packetFixed signature

Check for challenge

40(GetTickCount()/0xff)*2 mod 0xff
Data size (Little Endian)

Send the calculated challenge

1f

GetTickCount() mod 0xff

Decrypt implant andexecute in memory

Calculate the random
key and challenge

03
Command(GetTickCount()/0xff)>>1 mod 0xff

Send the DBGPRINT implant

Split implant intoencrypted blocks

Inside DBGPRINT Stager
DBGPRINT Controller

DBGPRINT Stager

Request the DBGPRINT implant
Generate request withpacket– Generatesession keys
sessionkeys
Calculate the random
key and challengeAuthentication key ⊕ Random number = Pre-session key
Send the calculated challenge
Checkfor challenge
Pre-session
key ⊕ 0x6162636465666768696A6B6C6D6E6F00 = Session key 1
Pre-session key ⊕ 0x01020304050607080900010203040506 = Session key 2
Decrypt implant andexecute in memory

Send the DBGPRINT implant

Split implant into
encrypted blocks

Inside DBGPRINT Stager
DBGPRINT Controller

DBGPRINT Stager
Generate requestpacket

Request the DBGPRINT implant
Generaterequest packet
with session keys
Generate request packet

Calculate the random
key and challenge

the00
calculated
00000000
da 40 1f b5 03Send
6d 2000 00 challenge
Checkfor challenge
0000000A 35 c5 da 9c ae 62 04 f7 5a 36 29 19 b3 37 2d 45 Session key 10000001A 55 a5 ba fc ce 02 64 97 3a 5c 43 77 dd 5d 47 43 Session key 2
Decrypt implant andexecute in memory

Send the DBGPRINT implant

Split implant into
encrypted blocks

Inside DBGPRINT Stager
DBGPRINT Controller

DBGPRINT Stager

Request the DBGPRINT implant
Generate request
with session keys
Calculatethepre-session
key and challenge
packetCalculate the random

Session key 1 ⊕ 0x6162636465666768696A6B6C6D6E6F00 = Pre-session
key
key and challenge
Pre-session key ⊕ Authentication key = Server challenge

Send the calculated challenge
Check for challenge Command for challenge

Server challenge

00000000 de 40 1f ee 01 bd 10 00 00 00 58 88 dc e1 84 f700000010 18 b2 50 8f 04 40 19 eb 47 a1
Send the DBGPRINT implant
Decrypt implant andSplit implant into
execute in memory
encrypted blocks

Inside DBGPRINT StagerDBGPRINT Controller

DBGPRINT Stager
Generate request
packetRequest the DBGPRINT implantwith session keys

Check for challenge

Calculate the random
key and challenge
if (Server challenge ⊕ Pre-session key) == Authentication
key:
Check for challenge

Decrypt implant andexecute in memory

Send thecalculated
challenge- Yes:
Continue- No: Abort---Send the DBGPRINT implant

Split implant into
encrypted blocks

Inside DBGPRINT Stager
DBGPRINT Controller

DBGPRINT Stager
Generate request
packetRequest the DBGPRINT implant

Split implant
encryptedblocks
withintosession
keys

Calculate the random# Modified_RC4_PRGA
key and challenge
for char in prga_data:
Send the calculated challenge
Check for challenge x = (x + 1) % 256
y = (y + box[x]) % 256
box[x], box[y] = box[y], box[x]z = (box[x] + box[y]) % 256
box[z] = ((box[z]<< DBGPRINT4) & 0xf0) +implant((box[z] >> 4) & 0x0f)
Send theDecrypt implant andSplit implant into
execute in memory

encrypted blocks

Inside DBGPRINT Stager
DBGPRINT ControllerDBGPRINT Stager
Generate request
packet0000001A
0000002A
0000003A
Check for challenge
0000004A
0000005A…
…
Decrypt implant
and…
execute in memory

Request the DBGPRINT implant

Split implant
encrypted
blockswithinto
session
keys
PRGA_data2

PRGA_data1

PRGA_data3

Calculate
90 15 8f 2a 96 e6 4e f8 91 ed 64 7c dc 46
47 30 the random
07 10 2c 6a 3d ac 47 e0 51 f7 86 02 07 2c key
5e and0a challenge
the38calculated
44 b9 Send
b6 f4
3d 63 79challenge
b3 d1 53 58 b3 f1 10 ac
95 35 52 17 f3 3b 1f ab 28 80 45 f2 c3 8c c2 d4
a7 62 5a 76 48 25 8e 33 31 ba 33 b0 19 46 b0 17
PRGA_data4

Send the DBGPRINT implant

Split implant into
encrypted blocks

Inside DBGPRINT Stager
DBGPRINT Stager

DBGPRINT Controller

Request the DBGPRINT implant
Generate request
withandsessionkeys
Decrypt
implant
executein memory
packetCalculate the random
key and challenge

RC4_KSA(Pre-session key)
the header
calculated =challenge
decrypted data Sendsize
RC4_PRGA(PRGA_data1)
Check for challenge
decrypted data size = Modified_RC4_PRGA(PRGA_data2)
decrypted data header = Modified_RC4_PRGA(PRGA_data3)
decrypted dataSend= Modified_RC4_PRGA(PRGA_data4)
the DBGPRINT implant

Decrypt implant andexecute in memory

Split implant into
encrypted blocks

uFile transfer / management

DBGPRINT ImplantCommand code

Capability

2

Enumerate disk drives

3

List files

4

Upload file to C2 server

5

Download file from C2 server

6

Rename file7

Create folder

8

Delete file10

Execute file11

Move file

12

NtSetInformationFile

DBGPRINT ImplantuWindows management / Screenshot
Command code

Capability

807808809810
811
812
814815

Enumerate Windows
Hide WindowsShow Windows
Close Windows
Minimize Windows
Maximize Windows
Screenshot
Set screenshot event signaled

DBGPRINT ImplantuRemote desktop connectionuProcess / Network connection / Service management
Command code

Capability

816
817
818
820
821
822
827

Remote desktop
Enumerate process
Terminate process
List network connection status
Abort a network connection
Enumerate services
Manipulate service

DBGPRINT ImplantuRemote shell / Registry management
Command code

Capability1006
10071008
2011
2013
2014
2015
2016

Start remote shell
Exit remote shell
Obtain remote shell PID
Enumerate registry
Create registry key
Set registry key
Delete registry key
Delete registry value

Evil Hidden in Shellcode: The Evolution of Malware DBGPRINT

Detection WarfareEliminate Patterns
1213141516......
èê..0.1.........
....Mutex.......
....login.narllab.com...........
................
................
................
................
................
............P.».
................
abcdefghijklmno.
./e.Oó{-cÓF5Ç².ä

F.P...M...~...H1....b.0.1.......
....M...........
................
................
................
................
................
................
................
................
................
........abcdefgh
ijklmno../e.O.{-MutexM}8ºýáÈÒß¶î3ù.¿R–¸...0.24........
.... ...........
....ÎÏÑÍÏÑÎÎÈÑÎÎ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿ©a..
................
................
........q.ßä®;©ò
Õ=uÌÓ.Wrê„.|žÚ„.
Space (0x20)

Eliminate Patterns
1213141516......
è...0.1.........
....Mutex.......
....usr.narllab.
com.............
................
................
................
................
................
............».P.
................
abcdefghijklmno.
./e.Oó{-cÓF5Ç².ä

´Þ‹·CV•Ô©.²´w;Ôó¸...0.17........
.... ...........
....ÎÏÑÇÑÉÑÌÍÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿP...
................
................
........¸ñî®.¥îù

Plain text

XOR with 0xff

F.P...M...~...H1....b.0.1.......
....M...........
................
................
................
................
................
................
................
................
................
........abcdefgh
ijklmno../e.O {cF5...........V.
Listen port....%hM]........

x64 Version

Self-Modifying Code
H.\$.H.l$.H.t$ WATAUAVAWH..0.....XH..!.....H......H......QPH1......XI. ....!....P...ko....I_....GqI..@.U...#b7.;...-K(4q..)..%.."......... .Z.u...I..C...M).L..PH..ATY.H1..........%h...X.(.eH.`.......PA\A..$=.... ..O. C.U:<w....{.a.....N{.C...qgB.._.z......q....-N.a.b....s.7..&..s.#t.u..I......I....XYH..H...H...u...x...H..H........E1.E1.H....N........ cO.31c.d.~......[w"S.-......V..`P...U..z....._#..VF.....U.`..&.A-/.}..
H..(...H........E1.E1.H......|......E1.L......L..h...1.H......H.D$PH.. ......"90...U..O.a1miH.Yr0E.4......Y.0=!...).!..O8.Hd..Y......mq......
vH.........(...I..H........1.9+v3L.L$PL..(...A.M.L........I..$H..tY..I j..v>...z..........gA0%...g@'.3..|'.|...&......qk...qy1.q..8l...(77"l.
...I...A..;+r...H......r..q...H....H....p...H..H..I..H........A..H..H. .}.......d.X.7tF....]...,....l..........?4-.....}.+G+'........d. .....
...P...H....h...H.\$XH.l$`H.t$hH..0A_A^A]A\_.H.\$.WH.. 3.H..H..H;.t<D. ...f}....t.q.D...N.....Y.a-.........q...6......m.K..W.[{ygZ.<).y......
C.H.L$@.D$8..D$9..D$:..D$;........D.8H..0D.?.D.?0D..H...|.H.\$0H.. _.H 8L...N4dx......cc...........^..Z{..3.".a.u.|D..eK..,....@..........p..
.\$.UVWH..@D......H......H......H........H........D......H......H..... .m.[.......kZ.|.<1.._W.Z{.)..kt.t.O.Y_.Z{.).....<1..I..Z{.).qkt.t.y...
.......u.H........H...H.........D......H..8...H........H..H....8...D.. C.zH....y...I....Z3.l....]3.jB......./.".5.0.C.|...../.".tt.y.Y..Z{.).
....H..8...H..................D......H..@...H........L.L$`L.D$hH..H... .kt.t.!{......).....<13..s[[{H..V.u.<y=....Z3.m.F.u.<};.....?l.gZ.<)..
.@...D......H..@...H..............A...D......H......H........D.D$`H.T$ !.......z..j<).q.C.._...].ykt........Z?.%..jt....B......5..jt..u.#.|.~hH........D......H......H..H........H........D.D$`H.L$h3.......D...... ..)...l.<1..I3.Z{.)..kt.t.y.E/+..I./.......C.._._(...N....!.......j..j
H.. ...H........A.....H..H.... ...D......H.. ...H..H........H..tv3.A.. <)...C.._......j5.41.C.|....]..kt.x.1..........j<).y=.1`|[{H..<....p.C...H........D......H..0...H......L._.H.G.H.L$(H..L.\$ H.D$0H.|$8...... ......]..ht.x.1..........j</...C..Y.o./h."........]._h...ND..M.{1`|[{H
L.L$ L..H..H....0...D......H..0...H........3.A.....H....8...H.L$h3.A.. ...NT......._......j0)...C.._.KI./...]...C.....H"/.".i...A....7l...+..
.....8...H........H........H.\$p.....H..@_^].@SH.. H..H.........H..D.. .1..Y..Z{.)...t.<1....C.yH.gZ6P..0.C..W.;..r.@SH.. H..H.........H..D..
....H..p...H........L..I..A..p...H.C.H.K.3.A.......8...L.[.H..A....... ....H..p...H........L..I..A..p...H.C.H.K.3.A.......8...L.[.H..A.......
....H.. [.H.\$.H.l$.H.t$.WATAUH..p...D......H..X...H......H..3.......D ....H.. [...m.K.~.~k.+[.r#.hp..O..^{H..P.u.<y=....Z3..'.jt.....1d|[{H.
.g.L..$P...A..H....X...D......H..X...H........D.G.H.T$@E3.H........... ..z8/...A......)...,.<1..M..Z{.)..kt.t.}.]_.Z{./h."...q.p.._...Z-.j.Z.
Only the wait-for-connection function is leftu.3..F...D......H......H........H.T$@H........D......H......H......... D.p...Y{H..Rnv.<y=.V..Z3.i.B.u.<y;.......1..jt....A......./.".i...B..T|$D&r...l$DH.T$HE3.D.E.H...........t.D......H..`...H.........U.L..$P.. &_..]ge...u......H.....<)..%............J=1..Ed.[{H......=1.......l.-.
.H.L$E..`...D......H..`...H........A.MZ..fD9\$E..A........H.L$ M...... j</p...]..Z{.).9kt.t.%#......].ykt.}.......B..j..5]....F.\........U.2c..........k..+.@...@...H.T.@......D......H..X...H........L..$`...H.L$ .4._....,...........U.....n4]...C.._..I./....=1..E<+..I./....\2.C.z.~[
A....X...D......H..X...H..........h...D......H..P.....H..i.<.........H .)...,.<1..M..Z{.)..kt.t.}.]_.Z{.1G.jt...VB......./...........P.....j<.T$@A.....H....P...D......H..P...H........H.T$FH.L$0A.....M..D.d$@D.l$ /h...v..Z{.)...$.<1..M..Z{.)..kt.t.}.]_.Z{./{.,</p...s..Z{.).....|u>/.

Before self-modifying

After self-modifying

Double DLL Sideloading(White) Benign EXE(Gray) Malicious DLL(Black) Malicious DLL

Anti ”SecurityProduct”
Injects

RC4 Decryption

Injects

Anti- “SecurityProduct”
Payload 1

SecurityProductsvchost.exe
Malicious DLL

Wait forconnection

RC4 Decryption

Injects

Actor
DBGPRINT Payload 2

Questions?
ycy@teamt5.org
aragorn@teamt5.org